Here is the first of several issues left outstanding today which we agreed we would resolve online.

In discussing the ideal default rule regarding property encountered by users (both innocent and nefarious), we all agreed that "everything should be public, unles the owner does XXXXXXX to 'container-ize' his property." What we disagreed on was what XXXXXXX should be. Should it be sufficient that he merely tags the property as private (e.g. sets up a web page that pops up before the rest of his web site that says "This site is for teenage girls only")? Should we require some sort of architectural barrier, such as a username and password screen? If so, how should we word the architectural barrier requirement, given that rapidly changing technology and costs will change drastically what is considered to be "reasonable measures"?

Please post, in response to this query, whether you agree with the following statements, and if not, what you counter-propose:

(1) The default should be that everything is public (2) unless it is tagged as being private (3) and has some additional form of architectural barrier.

----------

To get us started, here are my answers:

(1) Yes (2) Yes (3) No -- I don't think additional barriers are needed; mere signalling should be enough (as it is in real space).

-- Anonymous, November 23, 1998

Answers

(1) yes

(2) yes

(3) yes, where economically feasible

The only contentious issue seems to be (3). If we answer no to it, then we have exactly the same situation as in real space. This doesn't seem adequate because the purpose of cyberspace is for everyone to browse around freely, which is what we stated as one of our goals. Also, it is amazingly easy to put up technical barriers in 99% of the cases where you want to protect a page. This almost never involves additional cost. So, in the interest of free-flowing ideas, why not add this constraint for people who want private spaces on the net?

-- Anonymous, November 25, 1998

(1) yes (2) yes (3) yes

Labelling is not enough of a signal on the Web. I don't think it is reasonable to make the user liable for clicking on a link that leads to private space (there are many exceptions - for example, what if the page is written in a foreign language?). Simply clicking on a link does not constitute enough of a barrier and is not enough of a container around the private space.

For the situation of only wanting to permit a certain segment of the population without knowing exactly who that is, maybe a contract based regime would work. A person clicks on the link and then accepts some type of contract in order to enter the private space (this would be easy and cheap to do). Now, the contract provides that barrier we need and the contract governs liability.

-- Anonymous, November 23, 1998

(1) agree

(2) if this means only text designates the areas as private, I disagree; I don't think text only is enough. Since it is very easy to access URLs on the web, children, persons who can't read well and persons with learning disabilities could inadvertantly access a site marked 'private' and be prosecuted for unauthorized access. Since it is cheap to also include a password screen for a private web site (I think??), this should be done. Otherwise, there aren't sufficient costs associated with making spaces on the web private and I think we should encourage the imposition of these costs.

(3) agree

-- Anonymous, November 23, 1998

As the technical architecture person, I'm going to vote: yes, yes, yes.

The reason is: you can combine (2) and (3). That is, the "tagging" is also a barrier to entry. A simple "Don't come in" sign isn't quite enough (in code) although it might be enough for the law.

-- Anonymous, November 26, 1998

Just for the record:

It looks like everyone else thinks it should be (1) yes, (2) yes, (3) yes. I don't feel too strongly about this issue, so it looks like we're adopting that as our official stance. So our default is: Everything is public unless it is tagged as being private and has some additional, reasonable measure of architectural barrier. (In most web page cases, that will simply be a user ID and password screen.)

- Michelle.

-- Anonymous, November 29, 1998